feat: add upstream provider key aliases

[williamxhero]

Summary

• Add upstream provider credential aliases, such as displaying a Codex credential as WWP1 in usage and monitoring records.
• Store only (provider, SHA-256(api key)); the plaintext upstream key is never persisted in the alias table.
• Add a panel-authenticated management API and a reusable editor in both the Codex provider drawer and standalone Codex editor.
• Apply aliases consistently in Monitoring, Dashboard, and Usage Analytics, with aliases taking precedence over generic provider labels such as codex.
• Save the alias together with the provider form when the user clicks the existing Save button; there is no separate alias-save button.
• Add SQLite migration, repository tests, HTTP API tests, source resolver tests, monitoring display tests, and editor coverage.

Usage

1. Open the Codex provider editor.
2. Enter an alias such as WWP1 in the provider alias field.
3. Click the existing Save button at the bottom of the form.
4. Records that resolve to that provider key display the alias as the source name.

Security and compatibility

• The database stores only the SHA-256 digest of the provider key.
• Existing provider configuration and the existing inbound API key alias feature are unchanged.
• Aliases are unique case-insensitively within one provider.
• The management endpoint uses the existing panel authentication.

Verification

• npm run type-check
• Targeted Vitest: 3 files, 51 tests passed
• ESLint: no errors; existing repository warnings remain
• Production web build completed
• git diff --check and clean-baseline patch apply check passed